ServerPointer Address

Im using IDA Pro 5 to search for the addresses but im having problems finding the server pointer address. Can anybody help?

Thank You in Advance!

Originally Posted by RubberDuckY09

Im using IDA Pro 5 to search for the addresses but im having problems finding the server pointer address. Can anybody help?

Thank You in Advance!

Code:

seg000:0050753B                 mov     eax, ds:dword_9DD0A8   <========== server pointer
seg000:00507540                 cmp     eax, ebx
seg000:00507542                 jz      loc_507867
seg000:00507548                 cmp     dword ptr [eax+574h], 5  <========== GMMode offset
seg000:0050754F                 jl      loc_507867
seg000:00507555                 push    offset aKick    ; "/kick"     <========== search string

I'm not 100% sure but I think it is...

Im using IDA Pro to search for the addresses but im having problems finding the player pointers ang norecoil offset x y z address. Can anybody help please...

Thank You in Advance to teach me..

Originally Posted by Mr.NoNames

Im using IDA Pro to search for the addresses but im having problems finding the player pointers ang norecoil offset x y z address. Can anybody help please...

Thank You in Advance to teach me..

you can find it yourself. download WarRock dump(EU or PH) and addys for that. search addy of that dump using IDA Pro. find specific string(s) near that addy, or find specific value assigned for that addy e.g. dd 1.0 or dq 360...

your problem solved!

example - PH Dump(March 14th, 2013)

Code:

seg000:005790BB                 push    offset aIngame_gage_sp ; "Ingame_Gage_SP_0"   <========= search string
seg000:005790C0
seg000:005790C0 loc_5790C0:                             ; CODE XREF: sub_578EDB+19Aj
seg000:005790C0                                         ; sub_578EDB+1AFj ...
seg000:005790C0                 mov     ecx, [esi+0B0h]
seg000:005790C6                 call    sub_60C210
seg000:005790CB
seg000:005790CB loc_5790CB:                             ; CODE XREF: sub_578EDB+83j
seg000:005790CB                                         ; sub_578EDB+EDj ...
seg000:005790CB                 push    edi
seg000:005790CC                 mov     edi, ds:dword_AE356C    <====== player pointer 
seg000:005790D2                 mov     eax, [edi+0C498h]
seg000:005790D8                 imul    eax, 1D20h

Originally Posted by lagger

Code:

seg000:0050753B                 mov     eax, ds:dword_9DD0A8   <========== server pointer
seg000:00507540                 cmp     eax, ebx
seg000:00507542                 jz      loc_507867
seg000:00507548                 cmp     dword ptr [eax+574h], 5  <========== GMMode offset
seg000:0050754F                 jl      loc_507867
seg000:00507555                 push    offset aKick    ; "/kick"     <========== search string

I'm not 100% sure but I think it is...

Yes, but do you know how to know that that one is the correct one?
It's simple so i will explain it for people who don't understand it.
Code

Code:

seg000:0050753B                 mov     eax, ds:dword_9DD0A8 <- Server Adress gets stored inside eax
seg000:00507540                 cmp     eax, ebx <- you compare the eax with ebx
seg000:00507542                 jz      loc_507867 <- if it's zero we jump to 507867
seg000:00507548                 cmp     dword ptr [eax+574h], 5 <- as stated this is the Gm offset addy which is used in the server, so it's always the server pointer + the offset (574) and as we have seen a few moments ago eax = 9DD0A8 <- that's the server adress
seg000:0050754F                 jl      loc_507867 <- if eax+574 is lower then 5 we jump to 507867
seg000:00507555                 push    offset aKick    ; "/kick" <- can be used to easely trace the adress.

There is also a trick to calculate the adress once you have one of the two.
Example

Code:

PlayerPointer = 0x9C
ServerPointer = 0x??

ServerPointer = PlayerPointer + 0x70
PlayerPointer = ServerPointer - 0x70

->PlayerPointer = 0x9C
->ServerPointer = 0x10C
or ServerPointer = (PlayerPointer + 0x70)

Could be switched around but that's pretty much it.

Originally Posted by Alex_Agnew

Yes, but do you know how to know that that one is the correct one?
It's simple so i will explain it for people who don't understand it.
Code

Code:

seg000:0050753B                 mov     eax, ds:dword_9DD0A8 <- Server Adress gets stored inside eax
seg000:00507540                 cmp     eax, ebx <- you compare the eax with ebx
seg000:00507542                 jz      loc_507867 <- if it's zero we jump to 507867
seg000:00507548                 cmp     dword ptr [eax+574h], 5 <- as stated this is the Gm offset addy which is used in the server, so it's always the server pointer + the offset (574) and as we have seen a few moments ago eax = 9DD0A8 <- that's the server adress
seg000:0050754F                 jl      loc_507867 <- if eax+574 is lower then 5 we jump to 507867
seg000:00507555                 push    offset aKick    ; "/kick" <- can be used to easely trace the adress.

There is also a trick to calculate the adress once you have one of the two.
Example

Code:

PlayerPointer = 0x9C
ServerPointer = 0x??

ServerPointer = PlayerPointer + 0x70
PlayerPointer = ServerPointer - 0x70

->PlayerPointer = 0x9C
->ServerPointer = 0x10C
or ServerPointer = (PlayerPointer + 0x70)

Could be switched around but that's pretty much it.

nice tutorial but I doubt your PlayerPointer & ServerPointer calculation is correct.

Code:

#define ADR_PLAYERPOINTER  0xAF17F0
#define ADR_SERVERPOINTER  0xAEBFB8

#define ADR_PLAYERPOINTER 0xAED41C
#define ADR_SERVERPOINTER 0xAE7BE4


#define Adr_PlayerPTR    0x00AE2C00
#define Adr_ServerPTR    0x00AE3AC4

try to use critical thinking on that its like a reverse thinking if they give u one then u have now a clue

Originally Posted by F l a p J a c K ™

try to use critical thinking on that its like a reverse thinking if they give u one then u have now a clue

Like Addylogger

I don't understand it i try find wweapon addy then the string is You cannot enter a vehicle in prone pos i idon;t understand that..

Originally Posted by Alex_Agnew

Yes, but do you know how to know that that one is the correct one?
It's simple so i will explain it for people who don't understand it.
Code

Code:

seg000:0050753B                 mov     eax, ds:dword_9DD0A8 <- Server Adress gets stored inside eax
seg000:00507540                 cmp     eax, ebx <- you compare the eax with ebx
seg000:00507542                 jz      loc_507867 <- if it's zero we jump to 507867
seg000:00507548                 cmp     dword ptr [eax+574h], 5 <- as stated this is the Gm offset addy which is used in the server, so it's always the server pointer + the offset (574) and as we have seen a few moments ago eax = 9DD0A8 <- that's the server adress
seg000:0050754F                 jl      loc_507867 <- if eax+574 is lower then 5 we jump to 507867
seg000:00507555                 push    offset aKick    ; "/kick" <- can be used to easely trace the adress.

There is also a trick to calculate the adress once you have one of the two.
Example

Code:

PlayerPointer = 0x9C
ServerPointer = 0x??

ServerPointer = PlayerPointer + 0x70
PlayerPointer = ServerPointer - 0x70

->PlayerPointer = 0x9C
->ServerPointer = 0x10C
or ServerPointer = (PlayerPointer + 0x70)

Could be switched around but that's pretty much it.

sir can u tell me what is the string for gmmode addys? so i will looks like a gm ^_^

Originally Posted by killertime

sir can u tell me what is the string for gmmode addys? so i will looks like a gm ^_^

Thats already patched, you need to find a new way.

yeah you will get dc if you try to use the offset well it still works but if you try to spectate you will be kicked out of the lobby to the log in screen

Originally Posted by kevin0152

yeah you will get dc if you try to use the offset well it still works but if you try to spectate you will be kicked out of the lobby to the log in screen

unless you can bypass the connection terminated from server.

Originally Posted by pusongbato

unless you can bypass the connection terminated from server.

well if that can be bypassed gameguard bypassing would be easy

Originally Posted by Alex_Agnew

Thats already patched, you need to find a new way.

can u help me

ServerPointer Address

Post a Reply

Similar Threads

Tags for this Thread